ASD ISM 1767 Use SHA-2 with minimum 256-bit output
What it says
When using SHA-2 for hashing, an output size of at least 256 bits is used, preferably SHA-384 or SHA-512.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWhen using SHA-2, ensure the hash is at least 256 bits for better security.
When you use SHA-2, make sure the hash is at least 256 bits long-like picking a thicker padlock for better security. This is important because if you use a weaker hash, it's like leaving the door a little ajar, making it easier for cybercriminals to break in and steal or tamper with important information.
Free. Save your status, tasks and notes.
Why it matters
Using SHA-2 outputs under 256 bits (e.g., SHA-224) reduces collision resistance, increasing the risk of forged digests and compromised integrity of files, logs and signatures.
How to implement
IT team should verify hashing protocols: Confirm that current systems use SHA-2 with at least 256-bit outputs.
Review system configurations to ensure compliance and where necessary, update settings to SHA-384 or SHA-512.
Procurement should include security requirements: Ensure new software purchases specify SHA-2 with at least 256-bit output in the security criteria.
Include this requirement in vendor evaluations and documentation.
Managers should understand the risks: Educate team leaders about what hashing is and why choosing at least 256-bit output is crucial for security.
Use simple analogies, like padlocks and door strength, to illustrate.
System administrators should update legacy systems: Identify older systems potentially not using SHA-2 with the required output size and plan for updates or replacements.
Schedule upgrades during low-traffic periods to minimise disruptions.
Security officers should conduct periodic reviews: Set an annual review to check if SHA-2 is implemented with at least 256-bit output.
During these reviews, update any systems that might have fallen behind on this requirement.
Keep it running
Standardise on SHA-256 or stronger (prefer SHA-384/SHA-512) across applications, TLS/cert profiles and signing tools; explicitly disable SHA-224 and verify via config reviews and testing.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of systems using hashing algorithms: Request documentation clearly listing what hashing algorithms are in use and on which systems.
Look at
References to SHA-2 and confirm that output size is at least 256 bits.
Good evidence
Includes a complete and up-to-date list detailing output sizes for each system.
- Check 2 of 5What an auditor asks for
Ask for
Procurement records for new software: Review procurement records to see if the SHA-2 requirement is specified.
Look at
Vendor contracts or purchase orders for language specifying at least 256-bit outputs. Good records include clear specifications in contracts or evaluation documentation.
- Check 3 of 5What an auditor asks for
Ask for
System configuration records: Request system settings or configuration files for networks employing hashing.
Look at
Output sizes to confirm they meet the SHA-2 256-bit minimum.
Good evidence
Configuration will explicitly show the chosen algorithm and bit-length.
- Check 4 of 5What an auditor asks for
Ask for
Security training materials: Check team training records to see if hashing and the importance of a 256-bit minimum are covered.
Look at
Recently delivered training sessions highlighting this control. Good evidence shows recent sessions with attendee and date lists.
- Check 5 of 5What an auditor asks for
Ask for
Recent system audit reports: Obtain audit documents covering cryptographic compliance reviews.
Look at
Sections assessing hashing algorithms and their compliance with SHA-2 256-bit standards.
Good evidence
Audit report identifies any gaps and confirms compliant systems.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-1767 requires that when SHA-2 is used for hashing, organisations use an output size of at least 256 bits (preferably SHA-384 or SHA-512). ISO/IEC 27001:2022 Annex A 8.24 requires rules for the effective use of cryptography and cryptographic key management to be defined and implemented, which would include selecting approved hash algorithms and parameters such as SHA-2 output length. ISM-1767 is a specific cryptographic parameter requirement, whereas Annex A 8.24 is broader and covers cryptography governance and key management beyond hashing.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.